Bad Epoll CVE affecting Android

horde

A rare bug that can root Android. Most Linux privilege-escalation bugs cannot root Android at all. Copy Fail and its variants, for example, need modules that Android never loads. Out of the roughly 130 vulnerabilities exploited on Google's kernelCTF, only about ten are candidates for rooting Android. Bad Epoll is one of them.

The Android exploit is still in progress.

Pixel 10 (kernel v6.6+): the current PoC triggers the UAF and a full root exploit is in progress. We will release the Android exploit and writeup once they are complete.

Pixel 8 and other v6.1-based devices: not affected, since the bug was introduced in v6.4.

ClickClickDrone

horde
As mentioned in your post, this bug is not exploitable on any models before the Pixel 10 since only it uses the vulnerable 6.6 kernel, whereas older generations use the 6.1 version.

See a list of kernel versions used for each device here.

TL;DR: You probably don't need to panic unless you have a Pixel 10.

ClickClickDrone

ClickClickDrone
The patch has now been merged into GrapheneOS' 6.6 kernel!

Carrousel7956

Fixed before I unlocked my phone!

GrapheneOS

horde ClickClickDrone GrapheneOS has much stronger protection against use-after-free vulnerabilities in the kernel due to using hardware memory tagging (Pixel 8+) and zero-on-free for the kernel allocators. The patches for the vulnerability have been included and will be shipped in today's release.

ClickClickDrone

GrapheneOS
Would MTE and UAF protections by themselves mitigate this vulnerability for GrapheneOS?

de0u

ClickClickDrone When I looked, it seemed as if the exploit code for Android wasn't finished. It's hard to say for sure whether or not a specific exploit that isn't written would be caught by a particular mitigation portfolio! Especially since it could be the case that an exploit for a typical Android kernel that would fail on GrapheneOS could be tweaked further to work on GrapheneOS.

Luckily in a few days the number of GrapheneOS Pixel 10/devices that still have the bug should be small.

ClickClickDrone

ClickClickDrone
de0u

NOTE: I am not an expert at all on how memory tagging and kernel security work in-depth by a long shot, so please correct any incorrect assumptions.

Anyway, I believe "Bad Epoll" is much harder to pull off on GrapheneOS since it uses MTE in the kernel, which would catch the UAF needed to become root.

And that is assuming the device had not been updated to /202607050[01]/, which fixed the vuln.

ryrona

ClickClickDrone As mentioned in your post, this bug is not exploitable on any models before the Pixel 10 since only it uses the vulnerable 6.6 kernel, whereas older generations use the 6.1 version. ... TL;DR: You probably don't need to panic unless you have a Pixel 10.

Actually, GrapheneOS developers has backported the fix to 6.1 kernels too, so all Pixels should probably be assumed potentially vulnerable.

https://github.com/GrapheneOS/kernel_common-6.1/commits/17/

ClickClickDrone Anyway, I believe "Bad Epoll" is much harder to pull off on GrapheneOS since it uses MTE in the kernel, which would catch the UAF needed to become root.

Should be noted that only Pixel 8th gen and later has MTE support at all, so earlier generations may be affected even on GrapheneOS, unless any of the other kernel hardenings GrapheneOS has catches it.

ClickClickDrone

ryrona Actually, GrapheneOS developers has backported the fix to 6.1 kernels too, so all Pixels should probably be assumed potentially vulnerable.

Yes, my assumption that only 6.4+ kernels were affected was incorrect.